Tag: #supply-chain-attack33 results
Hackers stole an npm token from an axios maintainer to publish two malicious versions with a cross-platform RAT. The packages targeted macOS, Windows, and Linux, live for three hours and detected infecting 135 systems. This is the third major npm compromise in seven months, bypassing recommended defenses via CLI publish.
CrowdStrike, Cisco, and Palo Alto Networks launched agentic SOC tools at RSAC 2026, but all overlook distinguishing AI agent from human activity in logs. Adversary breakout times hit 27 seconds fastest, with 1,800 AI apps generating overwhelming logs. Supply chain attacks like ClawHavoc highlight rising risks.
Axios, a software tool used by millions to develop applications, was compromised overnight. The breach introduced a vulnerability in a key part of the internet's infrastructure.
A proof-of-concept attack on Context Hub shows AI supply chain vulnerabilities exploitable via poisoned documentation without malware. The service keeps coding agents updated on API calls but lacks robust content sanitization. This exposes a new risk vector for AI development tools.
Widely used Trivy vulnerability scanner is compromised in an ongoing supply-chain attack. Admins should rotate secrets immediately.
Polymarket confirmed a security breach where hackers injected malicious code into their website via a compromised third-party vendor. Over 11 victims lost approximately $3 million in cryptocurrency.
LastPass disclosed a security incident involving its third-party vendor Klue, where attackers used stolen OAuth tokens to access LastPass's Salesforce environment. The breach exposed customer CRM data but did not affect the password vault or encrypted credentials.
Docker Hub faced supply chain compromises with Trivy and Checkmarx KICS. Attackers used stolen publisher credentials to push malicious images via legitimate flows. Docker emphasizes open, fast collaboration to mitigate such threats.
Vercel, a cloud platform for hosting web apps, was breached by hackers who stole customer data like employee names and emails. ShinyHunters claimed responsibility and is selling the data. The attack exploited a compromised third-party AI tool.